Downloads.rar

Malware Config

Extracted

Credentials

Protocol: smtp

Host: mail.pro-powersourcing.com

Port: 587

Username: vivi@pro-powersourcing.com

Password: china1977

Extracted

Family formbook
C2

http://www.worstig.com/w9z/

http://www.norjax.com/app/

http://www.joomlas123.com/i0qi/

Decoy

crazzysex.com

hanferd.com

gteesrd.com

bayfrontbabyplace.com

jicuiquan.net

relationshiplink.net

ohchacyberphoto.com

kauegimenes.com

powerful-seldom.com

ketotoken.com

make-money-online-success.com

redgoldcollection.com

hannan-football.com

hamptondc.com

vllii.com

aa8520.com

platform35markethall.com

larozeimmo.com

oligopoly.net

llhak.info

fisioservice.com

tesla-magnumopus.com

cocodrilodigital.com

pinegrovesg.com

traveladventureswithme.com

hebitaixin.com

golphysi.com

gayjeans.com

quickhire.expert

randomviews1.com

eatatnobu.com

topmabati.com

mediaupside.com

spillerakademi.com

thebowtie.store

sensomaticloadcell.com

turismodemadrid.net

yuhe89.com

wernerkrug.com

cdpogo.net

dannynhois.com

realestatestructureddata.com

matewhereareyou.net

laimeibei.ltd

sw328.com

lmwworks.net

xtremefish.com

tonerias.com

dsooneclinicianexpert.com

281clara.com

Extracted

Family gozi_rm3
Botnet 86920224
C2

https://sibelikinciel.xyz

Attributes
build
300869
exe_type
loader
server_id
12
url_path
index.htm
rsa_pubkey.base64
serpent.plain

Extracted

Family danabot
C2

92.204.160.54

2.56.213.179

45.153.186.47

93.115.21.29

185.45.193.50

193.34.166.247

rsa_pubkey.plain

Extracted

Family qakbot
Botnet spx129
Campaign 1590734339
C2

94.10.81.239:443

94.52.160.116:443

67.0.74.119:443

175.137.136.79:443

73.232.165.200:995

79.119.67.149:443

62.38.111.70:2222

108.58.9.238:993

216.110.249.252:2222

67.209.195.198:3389

84.247.55.190:443

96.37.137.42:443

94.176.220.76:2222

173.245.152.231:443

96.227.122.123:443

188.192.75.8:995

24.229.245.124:995

71.163.225.75:443

75.71.77.59:443

104.36.135.227:443

173.173.77.164:443

207.255.161.8:2222

68.39.177.147:995

178.193.33.121:2222

72.209.191.27:443

67.165.206.193:995

64.19.74.29:995

117.199.195.112:443

75.87.161.32:995

188.173.214.88:443

173.22.120.11:2222

96.41.93.96:443

86.125.210.26:443

24.10.42.174:443

47.201.1.210:443

69.92.54.95:995

24.202.42.48:2222

47.205.231.60:443

66.26.160.37:443

65.131.44.40:995

24.110.96.149:443

108.58.9.238:443

77.159.149.74:443

74.56.167.31:443

75.137.239.211:443

47.153.115.154:995

173.172.205.216:443

184.98.104.7:995

24.46.40.189:2222

98.115.138.61:443

Extracted

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email Bit_decrypt@protonmail.com YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: Bit_decrypt@protonmail.com Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

Bit_decrypt@protonmail.com

Signatures 35

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • CoreEntity .NET Packer

    Description

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/2960-84-0x0000000004C40000-0x0000000004C42000-memory.dmpcoreentity
  • Danabot

    Description

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot x86 payload

    Description

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x0002000000019fad-249.datfamily_danabot
    behavioral1/files/0x0002000000019fad-252.datfamily_danabot
    behavioral1/files/0x0002000000019fad-251.datfamily_danabot
    behavioral1/files/0x0002000000019fad-261.datfamily_danabot
    behavioral1/files/0x0002000000019fad-260.datfamily_danabot
    behavioral1/files/0x000100000001ac77-413.datfamily_danabot
    behavioral1/files/0x000100000001ac77-412.datfamily_danabot
    behavioral1/files/0x000100000001ac77-416.datfamily_danabot
  • Dharma

    Description

    Dharma is a ransomware that uses security software installation to hide malicious activities.

  • Formbook

    Description

    Formbook is a data stealing malware which is capable of stealing data.

  • Gozi RM3

    Description

    A heavily modified version of Gozi using RM3 loader.

  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x000100000001aba6-44.datfamily_agenttesla
    behavioral1/files/0x000100000001aba6-43.datfamily_agenttesla
    behavioral1/files/0x000100000001abc7-193.datfamily_agenttesla
    behavioral1/files/0x000100000001abc7-192.datfamily_agenttesla
    behavioral1/memory/3224-254-0x0000000000400000-0x0000000000452000-memory.dmpfamily_agenttesla
    behavioral1/memory/3224-255-0x000000000044CCFE-mapping.dmpfamily_agenttesla
    behavioral1/memory/3644-273-0x0000000000400000-0x000000000044E000-memory.dmpfamily_agenttesla
    behavioral1/memory/3644-274-0x0000000000449E3E-mapping.dmpfamily_agenttesla
    behavioral1/memory/4888-339-0x000000000044C82E-mapping.dmpfamily_agenttesla
    behavioral1/memory/4888-338-0x0000000000400000-0x0000000000452000-memory.dmpfamily_agenttesla
    behavioral1/memory/4956-358-0x000000000044CF8E-mapping.dmpfamily_agenttesla
    behavioral1/memory/4956-364-0x00000000007C0000-0x0000000000812000-memory.dmpfamily_agenttesla
    behavioral1/memory/3368-444-0x0000000000400000-0x0000000000452000-memory.dmpfamily_agenttesla
    behavioral1/memory/3368-445-0x000000000044CB3E-mapping.dmpfamily_agenttesla
    behavioral1/memory/4672-464-0x0000000000400000-0x0000000000450000-memory.dmpfamily_agenttesla
    behavioral1/memory/4672-465-0x000000000044A49E-mapping.dmpfamily_agenttesla
  • CryptOne packer

    Description

    Detects CryptOne packer defined in NCC blogpost.

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x000100000001aba4-29.datcryptone
    behavioral1/files/0x000100000001aba4-28.datcryptone
    behavioral1/files/0x000100000001abb9-336.datcryptone
    behavioral1/files/0x000100000001abb9-335.datcryptone
    behavioral1/files/0x000100000001abb9-383.datcryptone
    behavioral1/files/0x000200000001a715-397.datcryptone
    behavioral1/files/0x000200000001a715-396.datcryptone
    behavioral1/files/0x000200000001a715-406.datcryptone
    behavioral1/files/0x000200000001a715-714.datcryptone
  • Formbook Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/3084-13-0x0000000000400000-0x000000000042D000-memory.dmpformbook
    behavioral1/memory/3084-14-0x000000000041E2D0-mapping.dmpformbook
    behavioral1/memory/1820-51-0x0000000000000000-mapping.dmpformbook
    behavioral1/memory/5112-227-0x0000000000400000-0x000000000042D000-memory.dmpformbook
    behavioral1/memory/5112-229-0x000000000041E270-mapping.dmpformbook
    behavioral1/memory/2160-247-0x0000000000000000-mapping.dmpformbook
    behavioral1/memory/1668-278-0x0000000000000000-mapping.dmpformbook
    behavioral1/memory/5048-426-0x000000000041E2D0-mapping.dmpformbook
    behavioral1/memory/3620-427-0x0000000000000000-mapping.dmpformbook
    behavioral1/memory/1820-434-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/3620-435-0x0000000000000000-mapping.dmpformbook
    behavioral1/memory/308-437-0x0000000000000000-mapping.dmpformbook
    behavioral1/memory/1668-456-0x0000000006D60000-0x0000000006EFE000-memory.dmpformbook
    behavioral1/memory/3620-457-0x0000000001D6BE5D-mapping.dmpformbook
    behavioral1/memory/5712-508-0x000000000041E270-mapping.dmpformbook
    behavioral1/memory/5788-511-0x0000000000000000-mapping.dmpformbook
    behavioral1/memory/6112-537-0x0000000000000000-mapping.dmpformbook
    behavioral1/memory/5052-543-0x0000000000000000-mapping.dmpformbook
    behavioral1/memory/1820-547-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-559-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-590-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-596-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-626-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-638-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-666-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-715-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-755-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-789-0x0000000005560000-0x0000000005657000-memory.dmpformbook
    behavioral1/memory/1820-812-0x0000000005560000-0x0000000005657000-memory.dmpformbook
  • Looks for VirtualBox Guest Additions in registry

    Tags

    TTPs

    Query RegistryVirtualization/Sandbox Evasion
  • rezer0

    Description

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/2960-88-0x00000000080D0000-0x0000000008123000-memory.dmprezer0
    behavioral1/memory/4232-318-0x0000000008940000-0x0000000008993000-memory.dmprezer0
    behavioral1/memory/2532-379-0x0000000008C90000-0x0000000008CE1000-memory.dmprezer0
  • Executes dropped EXE
    2.exe3.exe2.exe4.exe5.exe6.exe7.exe8.exe9.exe10.exe11.exe12.exe13.exe14.exe15.exe16.exeStyltendeschris.exe17.exe18.exefeeed.exe19.exe11.exe20.exe21.exe9.exe

    Reported IOCs

    pidprocess
    31002.exe
    42483.exe
    30842.exe
    5004.exe
    85.exe
    12646.exe
    20007.exe
    23088.exe
    29609.exe
    454810.exe
    398411.exe
    470812.exe
    101613.exe
    138414.exe
    477215.exe
    380816.exe
    2156Styltendeschris.exe
    445217.exe
    382418.exe
    4292feeed.exe
    308819.exe
    511211.exe
    511620.exe
    421621.exe
    40889.exe
  • Looks for VMWare Tools registry key

    Tags

    TTPs

    Query RegistryVirtualization/Sandbox Evasion
  • Checks BIOS information in registry
    11.exe

    Description

    BIOS information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion11.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion11.exe
  • Drops startup file
    16.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16.exe16.exe
  • Loads dropped DLL
    13.exe3.exeregsvr32.exe

    Reported IOCs

    pidprocess
    168013.exe
    31803.exe
    2848regsvr32.exe
    2848regsvr32.exe
  • Obfuscated with Agile.Net obfuscator

    Description

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/2308-50-0x0000000002F00000-0x0000000002F0F000-memory.dmpagile_net
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application
    reg.exe13.exe16.exe3.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Runreg.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\feeed = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\feeed.exe"reg.exe
    Key created\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce13.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\PANOREREDEOPTIM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trainbandanigon6\\Styltendeschris.vbs"13.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16.exe = "C:\\Windows\\System32\\16.exe"16.exe
    Key created\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce3.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Dokumen4 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dibromob\\PRECONCE.vbs"3.exe
  • Drops desktop.ini file(s)
    16.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\$Recycle.Bin\S-1-5-21-3341490333-719741536-2920803124-1000\desktop.ini16.exe
    File opened for modificationC:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini16.exe
    File opened for modificationC:\Program Files\desktop.ini16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI16.exe
  • Maps connected drives based on registry
    18.exe11.exe

    Description

    Disk information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum18.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\018.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum11.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\011.exe
  • Drops file in System32 directory
    16.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\System32\16.exe16.exe
  • Suspicious use of NtSetInformationThreadHideFromDebugger
    13.exe13.exe3.exe

    Reported IOCs

    pidprocess
    101613.exe
    168013.exe
    42483.exe
  • Suspicious use of SetThreadContext
    2.exe2.exe13.execmmon32.exe3.exe11.exe18.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3100 set thread context of 308431002.exe2.exe
    PID 3084 set thread context of 255230842.exeExplorer.EXE
    PID 1016 set thread context of 1680101613.exe13.exe
    PID 1820 set thread context of 25521820cmmon32.exeExplorer.EXE
    PID 4248 set thread context of 318042483.exe3.exe
    PID 3984 set thread context of 5112398411.exe11.exe
    PID 3824 set thread context of 2552382418.exeExplorer.EXE
  • Drops file in Program Files directory
    16.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\Microsoft Office\root\vreg\excelmui.msi.16.en-us.vreg.dat16.exe
    File opened for modificationC:\Program Files\Java\jre1.8.0_66\bin\servertool.exe.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\sg_16x11.png16.exe
    File createdC:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar16.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.surprise.small.scale-200.png16.exe
    File createdC:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp10.scale-100.png16.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\zh-cn.txt.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms16.exe
    File opened for modificationC:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-125.png16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_12h.png16.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496926306.profile.gz.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File createdC:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White@3x.png.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File createdC:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe16.exe
    File opened for modificationC:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerSmallTile.scale-125.png16.exe
    File opened for modificationC:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\WideTile.scale-125.png16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\AppxManifest.xml16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\11891_32x32x32.png16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File createdC:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\gu.pak.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_1c.png16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.scale-200.png16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GameEnd\gameEnd_background_gradient.png16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\mask\11d.png16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms16.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_sv.properties.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.h16.exe
    File createdC:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\uk.txt16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-16.png16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF16.exe
    File opened for modificationC:\Program Files\Google\Chrome\Application\86.0.4240.111\VisualElements\SmallLogoBeta.png16.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60.png16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\MainPageState2\tripeaks_bp_920.jpg16.exe
    File opened for modificationC:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Java\jre1.8.0_66\bin\jaas_nt.dll16.exe
    File createdC:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File createdC:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200.png16.exe
    File opened for modificationC:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\setup.exe.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml16.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\jre\lib\classlist16.exe
    File createdC:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO16.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exeschtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    4588schtasks.exe
    2340schtasks.exe
  • Modifies registry class
    cmd.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settingscmd.exe
  • Suspicious behavior: EnumeratesProcesses
    2.exe2.exe8.execmmon32.exe16.exe

    Reported IOCs

    pidprocess
    31002.exe
    31002.exe
    30842.exe
    30842.exe
    30842.exe
    30842.exe
    23088.exe
    1820cmmon32.exe
    1820cmmon32.exe
    1820cmmon32.exe
    1820cmmon32.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    23088.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    1820cmmon32.exe
    1820cmmon32.exe
    1820cmmon32.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    1820cmmon32.exe
    1820cmmon32.exe
    1820cmmon32.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
    380816.exe
  • Suspicious behavior: MapViewOfSection
    2.exe2.execmmon32.exe13.exe3.exe18.exe

    Reported IOCs

    pidprocess
    31002.exe
    30842.exe
    30842.exe
    30842.exe
    1820cmmon32.exe
    101613.exe
    1820cmmon32.exe
    42483.exe
    382418.exe
    382418.exe
    382418.exe
  • Suspicious use of AdjustPrivilegeToken
    2.exe5.exe8.execmmon32.exeExplorer.EXEfeeed.exe11.exe18.exe9.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege30842.exe
    Token: SeDebugPrivilege85.exe
    Token: SeDebugPrivilege23088.exe
    Token: SeDebugPrivilege1820cmmon32.exe
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeDebugPrivilege4292feeed.exe
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeDebugPrivilege398411.exe
    Token: SeDebugPrivilege382418.exe
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeShutdownPrivilege2552Explorer.EXE
    Token: SeCreatePagefilePrivilege2552Explorer.EXE
    Token: SeDebugPrivilege29609.exe
  • Suspicious use of SetWindowsHookEx
    3.exe5.exe7.exe13.exe15.exeStyltendeschris.exe19.exe20.exe

    Reported IOCs

    pidprocess
    42483.exe
    85.exe
    20007.exe
    101613.exe
    477215.exe
    2156Styltendeschris.exe
    308819.exe
    511620.exe
  • Suspicious use of WriteProcessMemory
    1.execmd.exe2.exeExplorer.EXE8.execmmon32.execmd.exe13.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4764 wrote to memory of 378847641.execmd.exe
    PID 4764 wrote to memory of 378847641.execmd.exe
    PID 3788 wrote to memory of 38203788cmd.exejavaw.exe
    PID 3788 wrote to memory of 38203788cmd.exejavaw.exe
    PID 3788 wrote to memory of 31003788cmd.exe2.exe
    PID 3788 wrote to memory of 31003788cmd.exe2.exe
    PID 3788 wrote to memory of 31003788cmd.exe2.exe
    PID 3788 wrote to memory of 42483788cmd.exe3.exe
    PID 3788 wrote to memory of 42483788cmd.exe3.exe
    PID 3788 wrote to memory of 42483788cmd.exe3.exe
    PID 3100 wrote to memory of 308431002.exe2.exe
    PID 3100 wrote to memory of 308431002.exe2.exe
    PID 3100 wrote to memory of 308431002.exe2.exe
    PID 3788 wrote to memory of 5003788cmd.exe4.exe
    PID 3788 wrote to memory of 5003788cmd.exe4.exe
    PID 3788 wrote to memory of 5003788cmd.exe4.exe
    PID 3788 wrote to memory of 83788cmd.exe5.exe
    PID 3788 wrote to memory of 83788cmd.exe5.exe
    PID 3788 wrote to memory of 83788cmd.exe5.exe
    PID 3788 wrote to memory of 12643788cmd.exe6.exe
    PID 3788 wrote to memory of 12643788cmd.exe6.exe
    PID 3788 wrote to memory of 12643788cmd.exe6.exe
    PID 2552 wrote to memory of 18202552Explorer.EXEcmmon32.exe
    PID 2552 wrote to memory of 18202552Explorer.EXEcmmon32.exe
    PID 2552 wrote to memory of 18202552Explorer.EXEcmmon32.exe
    PID 3788 wrote to memory of 20003788cmd.exe7.exe
    PID 3788 wrote to memory of 20003788cmd.exe7.exe
    PID 3788 wrote to memory of 20003788cmd.exe7.exe
    PID 3788 wrote to memory of 23083788cmd.exe8.exe
    PID 3788 wrote to memory of 23083788cmd.exe8.exe
    PID 3788 wrote to memory of 23083788cmd.exe8.exe
    PID 3788 wrote to memory of 29603788cmd.exe9.exe
    PID 3788 wrote to memory of 29603788cmd.exe9.exe
    PID 3788 wrote to memory of 29603788cmd.exe9.exe
    PID 2308 wrote to memory of 167623088.execmd.exe
    PID 2308 wrote to memory of 167623088.execmd.exe
    PID 2308 wrote to memory of 167623088.execmd.exe
    PID 3788 wrote to memory of 45483788cmd.exe10.exe
    PID 3788 wrote to memory of 45483788cmd.exe10.exe
    PID 3788 wrote to memory of 45483788cmd.exe10.exe
    PID 1820 wrote to memory of 45841820cmmon32.execmd.exe
    PID 1820 wrote to memory of 45841820cmmon32.execmd.exe
    PID 1820 wrote to memory of 45841820cmmon32.execmd.exe
    PID 3788 wrote to memory of 39843788cmd.exe11.exe
    PID 3788 wrote to memory of 39843788cmd.exe11.exe
    PID 3788 wrote to memory of 39843788cmd.exe11.exe
    PID 3788 wrote to memory of 47083788cmd.exe12.exe
    PID 3788 wrote to memory of 47083788cmd.exe12.exe
    PID 3788 wrote to memory of 47083788cmd.exe12.exe
    PID 1676 wrote to memory of 23521676cmd.exereg.exe
    PID 1676 wrote to memory of 23521676cmd.exereg.exe
    PID 1676 wrote to memory of 23521676cmd.exereg.exe
    PID 3788 wrote to memory of 10163788cmd.exe13.exe
    PID 3788 wrote to memory of 10163788cmd.exe13.exe
    PID 3788 wrote to memory of 10163788cmd.exe13.exe
    PID 3788 wrote to memory of 13843788cmd.exe14.exe
    PID 3788 wrote to memory of 13843788cmd.exe14.exe
    PID 3788 wrote to memory of 13843788cmd.exe14.exe
    PID 1016 wrote to memory of 1680101613.exe13.exe
    PID 1016 wrote to memory of 1680101613.exe13.exe
    PID 1016 wrote to memory of 1680101613.exe13.exe
    PID 1016 wrote to memory of 1680101613.exe13.exe
    PID 3788 wrote to memory of 47723788cmd.exe15.exe
    PID 3788 wrote to memory of 47723788cmd.exe15.exe
Processes 42
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe"
      Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Windows\System32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A202.tmp\A203.tmp\A204.bat C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe"
        Modifies registry class
        Suspicious use of WriteProcessMemory
        PID:3788
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"
          PID:3820
        • C:\Users\Admin\AppData\Roaming\2.exe
          C:\Users\Admin\AppData\Roaming\2.exe
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious behavior: EnumeratesProcesses
          Suspicious behavior: MapViewOfSection
          Suspicious use of WriteProcessMemory
          PID:3100
          • C:\Users\Admin\AppData\Roaming\2.exe
            C:\Users\Admin\AppData\Roaming\2.exe
            Executes dropped EXE
            Suspicious use of SetThreadContext
            Suspicious behavior: EnumeratesProcesses
            Suspicious behavior: MapViewOfSection
            Suspicious use of AdjustPrivilegeToken
            PID:3084
        • C:\Users\Admin\AppData\Roaming\3.exe
          C:\Users\Admin\AppData\Roaming\3.exe
          Executes dropped EXE
          Adds Run key to start application
          Suspicious use of NtSetInformationThreadHideFromDebugger
          Suspicious use of SetThreadContext
          Suspicious behavior: MapViewOfSection
          Suspicious use of SetWindowsHookEx
          PID:4248
          • C:\Users\Admin\AppData\Roaming\3.exe
            C:\Users\Admin\AppData\Roaming\3.exe
            Loads dropped DLL
            PID:3180
        • C:\Users\Admin\AppData\Roaming\4.exe
          C:\Users\Admin\AppData\Roaming\4.exe
          Executes dropped EXE
          PID:500
          • C:\Windows\SysWOW64\regsvr32.exe
            C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@500
            Loads dropped DLL
            PID:2848
        • C:\Users\Admin\AppData\Roaming\5.exe
          C:\Users\Admin\AppData\Roaming\5.exe
          Executes dropped EXE
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of SetWindowsHookEx
          PID:8
        • C:\Users\Admin\AppData\Roaming\6.exe
          C:\Users\Admin\AppData\Roaming\6.exe
          Executes dropped EXE
          PID:1264
        • C:\Users\Admin\AppData\Roaming\7.exe
          C:\Users\Admin\AppData\Roaming\7.exe
          Executes dropped EXE
          Suspicious use of SetWindowsHookEx
          PID:2000
        • C:\Users\Admin\AppData\Roaming\8.exe
          C:\Users\Admin\AppData\Roaming\8.exe
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
            Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
              Adds Run key to start application
              PID:2352
          • C:\Users\Admin\AppData\Roaming\feeed.exe
            "C:\Users\Admin\AppData\Roaming\feeed.exe"
            Executes dropped EXE
            Suspicious use of AdjustPrivilegeToken
            PID:4292
        • C:\Users\Admin\AppData\Roaming\9.exe
          C:\Users\Admin\AppData\Roaming\9.exe
          Executes dropped EXE
          Suspicious use of AdjustPrivilegeToken
          PID:2960
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5024.tmp"
            Creates scheduled task(s)
            PID:2340
          • C:\Users\Admin\AppData\Roaming\9.exe
            "{path}"
            Executes dropped EXE
            PID:4088
          • C:\Users\Admin\AppData\Roaming\9.exe
            "{path}"
            PID:3224
        • C:\Users\Admin\AppData\Roaming\10.exe
          C:\Users\Admin\AppData\Roaming\10.exe
          Executes dropped EXE
          PID:4548
        • C:\Users\Admin\AppData\Roaming\11.exe
          C:\Users\Admin\AppData\Roaming\11.exe
          Executes dropped EXE
          Checks BIOS information in registry
          Maps connected drives based on registry
          Suspicious use of SetThreadContext
          Suspicious use of AdjustPrivilegeToken
          PID:3984
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4CD9.tmp"
            Creates scheduled task(s)
            PID:4588
          • C:\Users\Admin\AppData\Roaming\11.exe
            "{path}"
            Executes dropped EXE
            PID:5112
        • C:\Users\Admin\AppData\Roaming\12.exe
          C:\Users\Admin\AppData\Roaming\12.exe
          Executes dropped EXE
          PID:4708
        • C:\Users\Admin\AppData\Roaming\13.exe
          C:\Users\Admin\AppData\Roaming\13.exe
          Executes dropped EXE
          Adds Run key to start application
          Suspicious use of NtSetInformationThreadHideFromDebugger
          Suspicious use of SetThreadContext
          Suspicious behavior: MapViewOfSection
          Suspicious use of SetWindowsHookEx
          Suspicious use of WriteProcessMemory
          PID:1016
          • C:\Users\Admin\AppData\Roaming\13.exe
            C:\Users\Admin\AppData\Roaming\13.exe
            Loads dropped DLL
            Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:1680
            • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
              "C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"
              Executes dropped EXE
              Suspicious use of SetWindowsHookEx
              PID:2156
        • C:\Users\Admin\AppData\Roaming\14.exe
          C:\Users\Admin\AppData\Roaming\14.exe
          Executes dropped EXE
          PID:1384
        • C:\Users\Admin\AppData\Roaming\15.exe
          C:\Users\Admin\AppData\Roaming\15.exe
          Executes dropped EXE
          Suspicious use of SetWindowsHookEx
          PID:4772
        • C:\Users\Admin\AppData\Roaming\16.exe
          C:\Users\Admin\AppData\Roaming\16.exe
          Executes dropped EXE
          Drops startup file
          Adds Run key to start application
          Drops desktop.ini file(s)
          Drops file in System32 directory
          Drops file in Program Files directory
          Suspicious behavior: EnumeratesProcesses
          PID:3808
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            PID:960
            • C:\Windows\system32\mode.com
              mode con cp select=1251
              PID:784
        • C:\Users\Admin\AppData\Roaming\17.exe
          C:\Users\Admin\AppData\Roaming\17.exe
          Executes dropped EXE
          PID:4452
        • C:\Users\Admin\AppData\Roaming\18.exe
          C:\Users\Admin\AppData\Roaming\18.exe
          Executes dropped EXE
          Maps connected drives based on registry
          Suspicious use of SetThreadContext
          Suspicious behavior: MapViewOfSection
          Suspicious use of AdjustPrivilegeToken
          PID:3824
        • C:\Users\Admin\AppData\Roaming\19.exe
          C:\Users\Admin\AppData\Roaming\19.exe
          Executes dropped EXE
          Suspicious use of SetWindowsHookEx
          PID:3088
        • C:\Users\Admin\AppData\Roaming\20.exe
          C:\Users\Admin\AppData\Roaming\20.exe
          Executes dropped EXE
          Suspicious use of SetWindowsHookEx
          PID:5116
        • C:\Users\Admin\AppData\Roaming\21.exe
          C:\Users\Admin\AppData\Roaming\21.exe
          Executes dropped EXE
          PID:4216
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Roaming\2.exe"
        PID:4584
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      PID:2160
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Program Files (x86)\Ebztp5xzp\qpc0z0hxrv.exe

                  MD5

                  bf15960dd7174427df765fd9f9203521

                  SHA1

                  cb1de1df0c3b1a1cc70a28629ac51d67901b17aa

                  SHA256

                  9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da

                  SHA512

                  7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

                • C:\Program Files (x86)\Ebztp5xzp\qpc0z0hxrv.exe

                  MD5

                  bf15960dd7174427df765fd9f9203521

                  SHA1

                  cb1de1df0c3b1a1cc70a28629ac51d67901b17aa

                  SHA256

                  9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da

                  SHA512

                  7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

                • C:\Program Files (x86)\Ebztp5xzp\qpc0z0hxrv.exe

                  MD5

                  bf15960dd7174427df765fd9f9203521

                  SHA1

                  cb1de1df0c3b1a1cc70a28629ac51d67901b17aa

                  SHA256

                  9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da

                  SHA512

                  7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

                • C:\Program Files (x86)\Eznqtlpth\zn9l_rbfdi.exe

                  MD5

                  9d4da0e623bb9bb818be455b4c5e97d8

                  SHA1

                  9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0

                  SHA256

                  091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8

                  SHA512

                  6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

                • C:\Program Files (x86)\Eznqtlpth\zn9l_rbfdi.exe

                  MD5

                  9d4da0e623bb9bb818be455b4c5e97d8

                  SHA1

                  9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0

                  SHA256

                  091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8

                  SHA512

                  6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

                • C:\Program Files (x86)\Eznqtlpth\zn9l_rbfdi.exe

                  MD5

                  9d4da0e623bb9bb818be455b4c5e97d8

                  SHA1

                  9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0

                  SHA256

                  091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8

                  SHA512

                  6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

                • C:\Program Files (x86)\Udpatc\bzhlgpg8uho01ny.exe

                  MD5

                  715c838e413a37aa8df1ef490b586afd

                  SHA1

                  4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1

                  SHA256

                  4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7

                  SHA512

                  af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

                • C:\Program Files (x86)\Udpatc\bzhlgpg8uho01ny.exe

                  MD5

                  715c838e413a37aa8df1ef490b586afd

                  SHA1

                  4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1

                  SHA256

                  4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7

                  SHA512

                  af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

                • C:\Program Files (x86)\Udpatc\bzhlgpg8uho01ny.exe

                  MD5

                  715c838e413a37aa8df1ef490b586afd

                  SHA1

                  4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1

                  SHA256

                  4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7

                  SHA512

                  af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

                  MD5

                  d7bfa7e0bb306cf07056428e20487b79

                  SHA1

                  fcfeed269e3d9df0ef8e638b8ef0927c05d5984f

                  SHA256

                  b25bba13e4b158098ccf3c6dff94a29c4e45546ada42fda01f056f4fccd04cc8

                  SHA512

                  c9936dd3c26a73c63ce702de42c923ca18aa64385b545a991b2c4ba0a0a8251fb909d2c3d0a2ad231ce5758037d7e77cb414003339dafcc67330a013dd6a618a

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\11.exe.log

                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\18.exe.log

                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8.exe.log

                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qpc0z0hxrv.exe.log

                  MD5

                  076d7c48064de4effadfe36d1857322d

                  SHA1

                  273f4d3f67c4ec0a637317ce2a536e52cc1c2090

                  SHA256

                  7cdcfb48cb249895caa7d3b5ce9ad53c7185d426f0f5669fe79bc5e047ff29ed

                  SHA512

                  e540c14a5093a1607dd47b0cdf96e21957d1b70aae24dcd99cdb3e3292451222760e8106b1e6e6091928b9998a6d307709e39081565a5e49d85c64e03bc55abf

                • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{68994E8F-2A50-11EB-BEBD-E625E128E840}.dat

                  MD5

                  aa37ce05fee33c61cc783b910ebab2cf

                  SHA1

                  a9e948a6df7a10e41c0b4866db1ce79dcea27f73

                  SHA256

                  d0e64a58cfb0dc0636d9af2b8e83432f176fd726714903282d2236004f52a27f

                  SHA512

                  513da03ad3858c9c49e00362c42d6541c0829df2ce8a1b4d93e960513d598feb964e560e0d4d2401f657f09189de5806dcb6b969bb5c01c34087ca3094eee414

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO

                  MD5

                  fcaf77269790e25b09f651f777698e9b

                  SHA1

                  49bb88c21026e2992f5f02e1a34b48ed16ea4f20

                  SHA256

                  7324a3b8b34ae6f4aecc93a0d6ea92fe59f9ca4cc051c7d07e375f09b7cb4a49

                  SHA512

                  efd5cde826390d6a9d0d1f8a86a670ca927cd8aed5684ee0f8a436bf6ad08cfb2572a76c5e439662c7eccb86f466a610110a3664b730334fbe746ea0c23df9e2

                • C:\Users\Admin\AppData\Local\Temp\A202.tmp\A203.tmp\A204.bat

                  MD5

                  ba36077af307d88636545bc8f585d208

                  SHA1

                  eafa5626810541319c01f14674199ab1f38c110c

                  SHA256

                  bec099c24451b843d1b5331686d5f4a2beff7630d5cd88819446f288983bda10

                  SHA512

                  933c2e5de3bc180db447e6864d7f0fa01e796d065fcd8f3d714086f49ec2f3ae8964c94695959beacf07d5785b569fd4365b7e999502d4afa060f4b833b68d80

                • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

                  MD5

                  91c9ae9c9a17a9db5e08b120e668c74c

                  SHA1

                  50770954c1ceb0bb6f1d5d3f2de2a0a065773723

                  SHA256

                  e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

                  SHA512

                  ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

                • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

                  MD5

                  91c9ae9c9a17a9db5e08b120e668c74c

                  SHA1

                  50770954c1ceb0bb6f1d5d3f2de2a0a065773723

                  SHA256

                  e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

                  SHA512

                  ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

                • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe

                  MD5

                  349f49be2b024c5f7232f77f3acd4ff6

                  SHA1

                  515721802486abd76f29ee6ed5b4481579ab88e5

                  SHA256

                  262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60

                  SHA512

                  a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

                • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe

                  MD5

                  349f49be2b024c5f7232f77f3acd4ff6

                  SHA1

                  515721802486abd76f29ee6ed5b4481579ab88e5

                  SHA256

                  262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60

                  SHA512

                  a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

                • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe

                  MD5

                  349f49be2b024c5f7232f77f3acd4ff6

                  SHA1

                  515721802486abd76f29ee6ed5b4481579ab88e5

                  SHA256

                  262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60

                  SHA512

                  a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

                • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.vbs

                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                • C:\Users\Admin\AppData\Local\Temp\tmp4CD9.tmp

                  MD5

                  70646144b001012b8878756a25967f16

                  SHA1

                  76675615642fe7b0d0916971a747effc1ae10441

                  SHA256

                  6ad97e909ecdb366ee470982aa1d85ec647831e7efbd3a3f440eb43f76207006

                  SHA512

                  83b1d268a82e304f4bc3d704160a34a52b65cdbdb7f54aa3cca58911b86e7c68410ebe29ff1d68ad0dbfe9b3cdee9f2fedf3d73870a2235fd0842b1074d44570

                • C:\Users\Admin\AppData\Local\Temp\tmp5024.tmp

                  MD5

                  cd840323e876fcabcae271047cd79834

                  SHA1

                  afc1ccfda6e05be869bf194c494b08c2c81af29b

                  SHA256

                  bff9709197a1ebf6db4b1f5eb2bcb6d3a54d1ac2d69544e3b05644f4336abd6e

                  SHA512

                  e08751e7fe9334744a01b6ed1cd75cc1ef464b08bdccefd2164bf47b3a64586bd21863fea541f0ae9a869642c5ad3f8e8e23b50ce5ab3ab2135c81653eeaf0d7

                • C:\Users\Admin\AppData\Local\Temp\tmp8DEA.tmp

                  MD5

                  70646144b001012b8878756a25967f16

                  SHA1

                  76675615642fe7b0d0916971a747effc1ae10441

                  SHA256

                  6ad97e909ecdb366ee470982aa1d85ec647831e7efbd3a3f440eb43f76207006

                  SHA512

                  83b1d268a82e304f4bc3d704160a34a52b65cdbdb7f54aa3cca58911b86e7c68410ebe29ff1d68ad0dbfe9b3cdee9f2fedf3d73870a2235fd0842b1074d44570

                • C:\Users\Admin\AppData\Local\Temp\tmpCB7A.tmp

                  MD5

                  e7fad64a625f79c0cb8b42020db6f33a

                  SHA1

                  9173a9ad5da8f36adb06305dafa6e8832c1aec84

                  SHA256

                  4bcc43e00ddadfea41e254fc990a5809464b6da9c1447b2b4c2e522e327da1fe

                  SHA512

                  bbec1eb5f231582eecfa179b1d4d225e9080f9e4ff0ffb39853a70e00a486a589d43a92d668eed8d731c225cd8539fd74c58025734aa2a3ef68e98d853b52c20

                • C:\Users\Admin\AppData\Roaming\-L3O44A9\-L3logim.jpeg

                  MD5

                  f094d32d1daa5b8fa23cdfd272689636

                  SHA1

                  4219943d6c424de45de2664f0e55985198bc8864

                  SHA256

                  db4a23adbaacc9c21d84f39bb9065e8a02449c20381db602b617b5d50aa88195

                  SHA512

                  e1334f32e63e66b6a83398b5064bcb3e36728a3269238f45b8e8dd9fb6e4baf38b7214e3215ceb78920ffc5c4343250aad552e964029d7ebbf9ae5482460c63c

                • C:\Users\Admin\AppData\Roaming\-L3O44A9\-L3logri.ini

                  MD5

                  d63a82e5d81e02e399090af26db0b9cb

                  SHA1

                  91d0014c8f54743bba141fd60c9d963f869d76c9

                  SHA256

                  eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

                  SHA512

                  38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

                • C:\Users\Admin\AppData\Roaming\-L3O44A9\-L3logrv.ini

                  MD5

                  ba3b6bc807d4f76794c4b81b09bb9ba5

                  SHA1

                  24cb89501f0212ff3095ecc0aba97dd563718fb1

                  SHA256

                  6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

                  SHA512

                  ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

                • C:\Users\Admin\AppData\Roaming\1.jar

                  MD5

                  a5d6701073dbe43510a41e667aaba464

                  SHA1

                  e3163114e4e9f85ffd41554ac07030ce84238d8c

                  SHA256

                  1d635c49289d43e71e2b10b10fbb9ea849a59eacedfdb035e25526043351831c

                  SHA512

                  52f711d102cb50fafefc2a9f2097660b950564ff8e9324471b9bd6b7355321d60152c78f74827b05b6332d140362bd2c638b8c9cdb961431ab5114e01851fbe4

                • C:\Users\Admin\AppData\Roaming\10.exe

                  MD5

                  68f96da1fc809dccda4235955ca508b0

                  SHA1

                  f182543199600e029747abb84c4448ac4cafef82

                  SHA256

                  34b63aa5d2cff68264891f11e8d6875a38ff28854e9723b1db9c154a5abe580c

                  SHA512

                  8512aa47d9d2062a8943239ab91a533ad0fa2757aac8dba53d240285069ddbbff8456df20c58e063661f7e245cb99ccbb49c6f9a81788d46072d5c8674da40f7

                • C:\Users\Admin\AppData\Roaming\10.exe

                  MD5

                  68f96da1fc809dccda4235955ca508b0

                  SHA1

                  f182543199600e029747abb84c4448ac4cafef82

                  SHA256

                  34b63aa5d2cff68264891f11e8d6875a38ff28854e9723b1db9c154a5abe580c

                  SHA512

                  8512aa47d9d2062a8943239ab91a533ad0fa2757aac8dba53d240285069ddbbff8456df20c58e063661f7e245cb99ccbb49c6f9a81788d46072d5c8674da40f7

                • C:\Users\Admin\AppData\Roaming\11.exe

                  MD5

                  9d4da0e623bb9bb818be455b4c5e97d8

                  SHA1

                  9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0

                  SHA256

                  091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8

                  SHA512

                  6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

                • C:\Users\Admin\AppData\Roaming\11.exe

                  MD5

                  9d4da0e623bb9bb818be455b4c5e97d8

                  SHA1

                  9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0

                  SHA256

                  091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8

                  SHA512

                  6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

                • C:\Users\Admin\AppData\Roaming\11.exe

                  MD5

                  9d4da0e623bb9bb818be455b4c5e97d8

                  SHA1

                  9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0

                  SHA256

                  091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8

                  SHA512

                  6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

                • C:\Users\Admin\AppData\Roaming\12.exe

                  MD5

                  192830b3974fa27116c067f019747b38

                  SHA1

                  469fd8a31d9f82438ab37413dae81eb25d275804

                  SHA256

                  116e5f36546b2ec14aba42ff69f2c9e18ecde3b64abb44797ac9efc6c6472bff

                  SHA512

                  74ebe5adb71c6669bc39fc9c8359cc6bc9bb1a77f5de8556a1730de23104fe95ec7a086c19f39706286b486314deafd7e043109414fd5ce0584f2fbbc6d0658a

                • C:\Users\Admin\AppData\Roaming\12.exe

                  MD5

                  192830b3974fa27116c067f019747b38

                  SHA1

                  469fd8a31d9f82438ab37413dae81eb25d275804

                  SHA256

                  116e5f36546b2ec14aba42ff69f2c9e18ecde3b64abb44797ac9efc6c6472bff

                  SHA512

                  74ebe5adb71c6669bc39fc9c8359cc6bc9bb1a77f5de8556a1730de23104fe95ec7a086c19f39706286b486314deafd7e043109414fd5ce0584f2fbbc6d0658a

                • C:\Users\Admin\AppData\Roaming\13.exe

                  MD5

                  349f49be2b024c5f7232f77f3acd4ff6

                  SHA1

                  515721802486abd76f29ee6ed5b4481579ab88e5

                  SHA256

                  262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60

                  SHA512

                  a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

                • C:\Users\Admin\AppData\Roaming\13.exe

                  MD5

                  349f49be2b024c5f7232f77f3acd4ff6

                  SHA1

                  515721802486abd76f29ee6ed5b4481579ab88e5

                  SHA256

                  262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60

                  SHA512

                  a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

                • C:\Users\Admin\AppData\Roaming\13.exe

                  MD5

                  349f49be2b024c5f7232f77f3acd4ff6

                  SHA1

                  515721802486abd76f29ee6ed5b4481579ab88e5

                  SHA256

                  262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60

                  SHA512

                  a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

                • C:\Users\Admin\AppData\Roaming\14.exe

                  MD5

                  9acd34bcff86e2c01bf5e6675f013b17

                  SHA1

                  59bc42d62fbd99dd0f17dec175ea6c2a168f217a

                  SHA256

                  384fef8417014b298dca5ae9e16226348bda61198065973537f4907ac2aa1a60

                  SHA512

                  9de65becdfc9aaab9710651376684ee697015f3a8d3695a5664535d9dfc34f2343ce4209549cbf09080a0b527e78a253f19169d9c6eb6e4d4a03d1b31ded8933

                • C:\Users\Admin\AppData\Roaming\14.exe

                  MD5

                  9acd34bcff86e2c01bf5e6675f013b17

                  SHA1

                  59bc42d62fbd99dd0f17dec175ea6c2a168f217a

                  SHA256

                  384fef8417014b298dca5ae9e16226348bda61198065973537f4907ac2aa1a60

                  SHA512

                  9de65becdfc9aaab9710651376684ee697015f3a8d3695a5664535d9dfc34f2343ce4209549cbf09080a0b527e78a253f19169d9c6eb6e4d4a03d1b31ded8933

                • C:\Users\Admin\AppData\Roaming\15.exe

                  MD5

                  d43d9558d37cdac1690fdeec0af1b38d

                  SHA1

                  98e6dfdd79f43f0971c0eaa58f18bce0e8cbf555

                  SHA256

                  501c921311164470ca8cb02e66146d8e3f36baa54bfc3ecb3a1a0ed3186ecbc5

                  SHA512

                  9a357c1bbc153ddc017da08c691730a47ab0ff50834cdc69540ede093d17d432789586d8074a4a8816fb1928a511f2a899362bb03feab16ca231adfdc0004aca

                • C:\Users\Admin\AppData\Roaming\15.exe

                  MD5

                  d43d9558d37cdac1690fdeec0af1b38d

                  SHA1

                  98e6dfdd79f43f0971c0eaa58f18bce0e8cbf555

                  SHA256

                  501c921311164470ca8cb02e66146d8e3f36baa54bfc3ecb3a1a0ed3186ecbc5

                  SHA512

                  9a357c1bbc153ddc017da08c691730a47ab0ff50834cdc69540ede093d17d432789586d8074a4a8816fb1928a511f2a899362bb03feab16ca231adfdc0004aca

                • C:\Users\Admin\AppData\Roaming\16.exe

                  MD5

                  56ba37144bd63d39f23d25dae471054e

                  SHA1

                  088e2aff607981dfe5249ce58121ceae0d1db577

                  SHA256

                  307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3

                  SHA512

                  6e086bea3389412f6a9fa11e2caa2887db5128c2ad1030685e6841d7d199b63c6d9a76fb9d1ed9116afd851485501843f72af8366537a8283de2f9ab7f3d56f0

                • C:\Users\Admin\AppData\Roaming\16.exe

                  MD5

                  56ba37144bd63d39f23d25dae471054e

                  SHA1

                  088e2aff607981dfe5249ce58121ceae0d1db577

                  SHA256

                  307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3

                  SHA512

                  6e086bea3389412f6a9fa11e2caa2887db5128c2ad1030685e6841d7d199b63c6d9a76fb9d1ed9116afd851485501843f72af8366537a8283de2f9ab7f3d56f0

                • C:\Users\Admin\AppData\Roaming\17.exe

                  MD5

                  15a05615d617394afc0231fc47444394

                  SHA1

                  d1253f7c5b10e7a46e084329c36f7692b41c6d59

                  SHA256

                  596566f6cb70d55b1b0978a0fab4cffd5049559545fe7ee2fa3897ccbc46c013

                  SHA512

                  6deea7c0c3795de7360b11fa04384e0956520a3a7bf5405d411b58487a35bba51eaca51c1e2dda910d4159c22179a9161d84da52193e376dfdf6bdfbe8e9f0f1

                • C:\Users\Admin\AppData\Roaming\17.exe

                  MD5

                  15a05615d617394afc0231fc47444394

                  SHA1

                  d1253f7c5b10e7a46e084329c36f7692b41c6d59

                  SHA256

                  596566f6cb70d55b1b0978a0fab4cffd5049559545fe7ee2fa3897ccbc46c013

                  SHA512

                  6deea7c0c3795de7360b11fa04384e0956520a3a7bf5405d411b58487a35bba51eaca51c1e2dda910d4159c22179a9161d84da52193e376dfdf6bdfbe8e9f0f1

                • C:\Users\Admin\AppData\Roaming\18.exe

                  MD5

                  bf15960dd7174427df765fd9f9203521

                  SHA1

                  cb1de1df0c3b1a1cc70a28629ac51d67901b17aa

                  SHA256

                  9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da

                  SHA512

                  7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

                • C:\Users\Admin\AppData\Roaming\18.exe

                  MD5

                  bf15960dd7174427df765fd9f9203521

                  SHA1

                  cb1de1df0c3b1a1cc70a28629ac51d67901b17aa

                  SHA256

                  9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da

                  SHA512

                  7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

                • C:\Users\Admin\AppData\Roaming\19.exe

                  MD5

                  ff96cd537ecded6e76c83b0da2a6d03c

                  SHA1

                  ec05b49da2f8d74b95560602b39db3943de414cb

                  SHA256

                  7897571671717742304acde430e5959c09fd9c29fbbe808105f00a1f663927ac

                  SHA512

                  24a827fda9db76c030852ef2db73c6b75913c9ee55e130a3c9a7c6ff7aff0fb7192ff1c47cd266b91500a04657b2da61a5fc00e48e7fbc27a6cbc9b7d91daa4b

                • C:\Users\Admin\AppData\Roaming\19.exe

                  MD5

                  ff96cd537ecded6e76c83b0da2a6d03c

                  SHA1

                  ec05b49da2f8d74b95560602b39db3943de414cb

                  SHA256

                  7897571671717742304acde430e5959c09fd9c29fbbe808105f00a1f663927ac

                  SHA512

                  24a827fda9db76c030852ef2db73c6b75913c9ee55e130a3c9a7c6ff7aff0fb7192ff1c47cd266b91500a04657b2da61a5fc00e48e7fbc27a6cbc9b7d91daa4b

                • C:\Users\Admin\AppData\Roaming\2.exe

                  MD5

                  715c838e413a37aa8df1ef490b586afd

                  SHA1

                  4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1

                  SHA256

                  4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7

                  SHA512

                  af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

                • C:\Users\Admin\AppData\Roaming\2.exe

                  MD5

                  715c838e413a37aa8df1ef490b586afd

                  SHA1

                  4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1

                  SHA256

                  4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7

                  SHA512

                  af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

                • C:\Users\Admin\AppData\Roaming\2.exe

                  MD5

                  715c838e413a37aa8df1ef490b586afd

                  SHA1

                  4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1

                  SHA256

                  4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7

                  SHA512

                  af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

                • C:\Users\Admin\AppData\Roaming\20.exe

                  MD5

                  ddcdc714bedffb59133570c3a2b7913f

                  SHA1

                  d21953fa497a541f185ed87553a7c24ffc8a67ce

                  SHA256

                  be3e6008dde30cb959b90a332a79931b889216a9483944dc5c0d958dec1b8e46

                  SHA512

                  a1d728751490c6cf21f9597c6df6f8db857c28d224b2d03e6d25ce8f17557accbd8ef2972369337b9d3305d5b9029001e5300825c23ce826884dcee55b37562c

                • C:\Users\Admin\AppData\Roaming\20.exe

                  MD5

                  ddcdc714bedffb59133570c3a2b7913f

                  SHA1

                  d21953fa497a541f185ed87553a7c24ffc8a67ce

                  SHA256

                  be3e6008dde30cb959b90a332a79931b889216a9483944dc5c0d958dec1b8e46

                  SHA512

                  a1d728751490c6cf21f9597c6df6f8db857c28d224b2d03e6d25ce8f17557accbd8ef2972369337b9d3305d5b9029001e5300825c23ce826884dcee55b37562c

                • C:\Users\Admin\AppData\Roaming\21.exe

                  MD5

                  9a7f746e51775ca001efd6ecd6ca57ea

                  SHA1

                  7ea50de8dd8c82a7673b97bb7ccd665d98de2300

                  SHA256

                  c4c308629a06c9a4af93fbd747ed2421e2ff2460347352366e51b91d19737400

                  SHA512

                  20cd6af47a92b396ae565e0a21d3acaa0d3a74bcdccc1506a55dea891da912b03256ba9900c2c089fe44d71210e3c100ba4601cf4d6c9b492a2ce0d323d4c57f

                • C:\Users\Admin\AppData\Roaming\21.exe

                  MD5

                  9a7f746e51775ca001efd6ecd6ca57ea

                  SHA1

                  7ea50de8dd8c82a7673b97bb7ccd665d98de2300

                  SHA256

                  c4c308629a06c9a4af93fbd747ed2421e2ff2460347352366e51b91d19737400

                  SHA512

                  20cd6af47a92b396ae565e0a21d3acaa0d3a74bcdccc1506a55dea891da912b03256ba9900c2c089fe44d71210e3c100ba4601cf4d6c9b492a2ce0d323d4c57f

                • C:\Users\Admin\AppData\Roaming\21.exe

                  MD5

                  9a7f746e51775ca001efd6ecd6ca57ea

                  SHA1

                  7ea50de8dd8c82a7673b97bb7ccd665d98de2300

                  SHA256

                  c4c308629a06c9a4af93fbd747ed2421e2ff2460347352366e51b91d19737400

                  SHA512

                  20cd6af47a92b396ae565e0a21d3acaa0d3a74bcdccc1506a55dea891da912b03256ba9900c2c089fe44d71210e3c100ba4601cf4d6c9b492a2ce0d323d4c57f

                • C:\Users\Admin\AppData\Roaming\22.exe

                  MD5

                  48e9df7a479e3fd63064ec66e2283a45

                  SHA1

                  a8dcce44de655a97a3448758b397a37d1f7db549

                  SHA256

                  c7d8c3c379dcc42fa796b07b6a9155826d39cbd2f264bc68d22a63b17c8ef7df

                  SHA512

                  6cc839f118cad9982ec998665b409dc297a8cff9b23ec2a9105d15cf58d9adbf46d0048dda76c8e1574f6288d901912b7de373920b68b53dbda43d6075611016

                • C:\Users\Admin\AppData\Roaming\22.exe

                  MD5

                  48e9df7a479e3fd63064ec66e2283a45

                  SHA1

                  a8dcce44de655a97a3448758b397a37d1f7db549

                  SHA256

                  c7d8c3c379dcc42fa796b07b6a9155826d39cbd2f264bc68d22a63b17c8ef7df

                  SHA512

                  6cc839f118cad9982ec998665b409dc297a8cff9b23ec2a9105d15cf58d9adbf46d0048dda76c8e1574f6288d901912b7de373920b68b53dbda43d6075611016

                • C:\Users\Admin\AppData\Roaming\23.exe

                  MD5

                  0dca3348a8b579a1bfa93b4f5b25cddd

                  SHA1

                  1ee1bcfd80cd7713093f9c053ef2d8c2cd673cd7

                  SHA256

                  c430a15c1712a571b0cd3ed0e5dfeefa7e78865a91bdc12e66666cd37c0e9654

                  SHA512

                  f0a17a940dd1c956f2578ed852e94631a9762fdd825ed5160b3758e427e8efa2ff0bfc83f239976b1d2765fefc8f9182e41c2da8f5746b36d4b7d189cb14a1b8

                • C:\Users\Admin\AppData\Roaming\23.exe

                  MD5

                  0dca3348a8b579a1bfa93b4f5b25cddd

                  SHA1

                  1ee1bcfd80cd7713093f9c053ef2d8c2cd673cd7

                  SHA256

                  c430a15c1712a571b0cd3ed0e5dfeefa7e78865a91bdc12e66666cd37c0e9654

                  SHA512

                  f0a17a940dd1c956f2578ed852e94631a9762fdd825ed5160b3758e427e8efa2ff0bfc83f239976b1d2765fefc8f9182e41c2da8f5746b36d4b7d189cb14a1b8

                • C:\Users\Admin\AppData\Roaming\24.exe

                  MD5

                  43728c30a355702a47c8189c08f84661

                  SHA1

                  790873601f3d12522873f86ca1a87bf922f83205

                  SHA256

                  cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44

                  SHA512

                  b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

                • C:\Users\Admin\AppData\Roaming\24.exe

                  MD5

                  43728c30a355702a47c8189c08f84661

                  SHA1

                  790873601f3d12522873f86ca1a87bf922f83205

                  SHA256

                  cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44

                  SHA512

                  b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

                • C:\Users\Admin\AppData\Roaming\24.exe

                  MD5

                  43728c30a355702a47c8189c08f84661

                  SHA1

                  790873601f3d12522873f86ca1a87bf922f83205

                  SHA256

                  cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44

                  SHA512

                  b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

                • C:\Users\Admin\AppData\Roaming\24.exe

                  MD5

                  43728c30a355702a47c8189c08f84661

                  SHA1

                  790873601f3d12522873f86ca1a87bf922f83205

                  SHA256

                  cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44

                  SHA512

                  b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

                • C:\Users\Admin\AppData\Roaming\25.exe

                  MD5

                  4bbcdf7f9deb1025ca56fa728d1fff48

                  SHA1

                  bdc80dfb759c221a850ac29664a27efd8d718a89

                  SHA256

                  d2c49ce7e49109214a98eaa2d39f0749c1e779bd139af1cadae55e1ccb55753b

                  SHA512

                  ea78c4935864dcddbf6f0516e1d5c095c4814ac988ccc038d0dc11c1fab7127ded45ff35b12bad845422c20f45311101706f0ef14cb1d629277ae276a2535383

                • C:\Users\Admin\AppData\Roaming\25.exe

                  MD5

                  4bbcdf7f9deb1025ca56fa728d1fff48

                  SHA1

                  bdc80dfb759c221a850ac29664a27efd8d718a89

                  SHA256

                  d2c49ce7e49109214a98eaa2d39f0749c1e779bd139af1cadae55e1ccb55753b

                  SHA512

                  ea78c4935864dcddbf6f0516e1d5c095c4814ac988ccc038d0dc11c1fab7127ded45ff35b12bad845422c20f45311101706f0ef14cb1d629277ae276a2535383

                • C:\Users\Admin\AppData\Roaming\26.exe

                  MD5

                  c3da5cb8e079024e6d554be1732c51cf

                  SHA1

                  e8f4499366fe67c9ae6fd1f5acbf56a9b956d4c3

                  SHA256

                  d7479a2f9f080742d17077fb4ccfc24583fa7a35842ba505cd43ed266734ce1f

                  SHA512

                  2395e084aef01c2a3f18524ee2c860f21e785849ce588a6ac7f58b45b6f7ba6dd25c052c49cc41dd72b3ebb7d476d88787aa273af82afc6fe17eb9e0ad4d7043

                • C:\Users\Admin\AppData\Roaming\26.exe

                  MD5

                  c3da5cb8e079024e6d554be1732c51cf

                  SHA1

                  e8f4499366fe67c9ae6fd1f5acbf56a9b956d4c3

                  SHA256

                  d7479a2f9f080742d17077fb4ccfc24583fa7a35842ba505cd43ed266734ce1f

                  SHA512

                  2395e084aef01c2a3f18524ee2c860f21e785849ce588a6ac7f58b45b6f7ba6dd25c052c49cc41dd72b3ebb7d476d88787aa273af82afc6fe17eb9e0ad4d7043

                • C:\Users\Admin\AppData\Roaming\26.exe

                  MD5

                  c3da5cb8e079024e6d554be1732c51cf

                  SHA1

                  e8f4499366fe67c9ae6fd1f5acbf56a9b956d4c3

                  SHA256

                  d7479a2f9f080742d17077fb4ccfc24583fa7a35842ba505cd43ed266734ce1f

                  SHA512

                  2395e084aef01c2a3f18524ee2c860f21e785849ce588a6ac7f58b45b6f7ba6dd25c052c49cc41dd72b3ebb7d476d88787aa273af82afc6fe17eb9e0ad4d7043

                • C:\Users\Admin\AppData\Roaming\27.exe

                  MD5

                  3d2c6861b6d0899004f8abe7362f45b7

                  SHA1

                  33855b9a9a52f9183788b169cc5d57e6ad9da994

                  SHA256

                  dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

                  SHA512

                  19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

                • C:\Users\Admin\AppData\Roaming\27.exe

                  MD5

                  3d2c6861b6d0899004f8abe7362f45b7

                  SHA1

                  33855b9a9a52f9183788b169cc5d57e6ad9da994

                  SHA256

                  dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

                  SHA512

                  19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

                • C:\Users\Admin\AppData\Roaming\27.exe

                  MD5

                  3d2c6861b6d0899004f8abe7362f45b7

                  SHA1

                  33855b9a9a52f9183788b169cc5d57e6ad9da994

                  SHA256

                  dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

                  SHA512

                  19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

                • C:\Users\Admin\AppData\Roaming\28.exe

                  MD5

                  2ef457653d8aeb241637c8358b39863f

                  SHA1

                  578ed06d6c32c44f69a2c2454f289fb0a5591f30

                  SHA256

                  dcffe599c886878ed4bed045140bd13d7bc9bd5085163ea00857aa09a93f4060

                  SHA512

                  16f98c1d29b8cfaaf3003c5264ca6b4363764c351d5106919eaf2c3bfab26e0fb189dd0e0b82b4d294ba5f3fe535d71cd25c93c2bf9fd27d84c2dd0a2bc99b69

                • C:\Users\Admin\AppData\Roaming\28.exe

                  MD5

                  2ef457653d8aeb241637c8358b39863f

                  SHA1

                  578ed06d6c32c44f69a2c2454f289fb0a5591f30

                  SHA256

                  dcffe599c886878ed4bed045140bd13d7bc9bd5085163ea00857aa09a93f4060

                  SHA512

                  16f98c1d29b8cfaaf3003c5264ca6b4363764c351d5106919eaf2c3bfab26e0fb189dd0e0b82b4d294ba5f3fe535d71cd25c93c2bf9fd27d84c2dd0a2bc99b69

                • C:\Users\Admin\AppData\Roaming\29.dll

                  MD5

                  986d769a639a877a9b8f4fb3c8616911

                  SHA1

                  ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

                  SHA256

                  c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

                  SHA512

                  3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

                • C:\Users\Admin\AppData\Roaming\29.exe

                  MD5

                  0009efe13eaf4dd3d091bc6e9ca7c1e7

                  SHA1

                  f2be84149784db1d1b7746afde07d781805bd35f

                  SHA256

                  de30d86cff3d838162aa88112a946dfb3af84005dda6bbc70cee15e8dff70ba3

                  SHA512

                  cf96410d5a528b52d92c37fac77ff3a8326ad6c2b3bbe00b44d55c758c5521870b9149b2fe8f743e6e7d90259eab5b3d19ed253abb8bea7660530c9b9ea70405

                • C:\Users\Admin\AppData\Roaming\29.exe

                  MD5

                  0009efe13eaf4dd3d091bc6e9ca7c1e7

                  SHA1

                  f2be84149784db1d1b7746afde07d781805bd35f

                  SHA256

                  de30d86cff3d838162aa88112a946dfb3af84005dda6bbc70cee15e8dff70ba3

                  SHA512

                  cf96410d5a528b52d92c37fac77ff3a8326ad6c2b3bbe00b44d55c758c5521870b9149b2fe8f743e6e7d90259eab5b3d19ed253abb8bea7660530c9b9ea70405

                • C:\Users\Admin\AppData\Roaming\3.exe

                  MD5

                  d2e2c65fc9098a1c6a4c00f9036aa095

                  SHA1

                  c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd

                  SHA256

                  4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8

                  SHA512

                  b5bd047ca4ee73965719669b29478a9d33665752e1dbe0f575a2da759b90819e64125675da749624b2d8c580707fd6a932685ab3962b5b88353981e857fe9793

                • C:\Users\Admin\AppData\Roaming\3.exe

                  MD5

                  d2e2c65fc9098a1c6a4c00f9036aa095

                  SHA1

                  c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd

                  SHA256

                  4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8

                  SHA512

                  b5bd047ca4ee73965719669b29478a9d33665752e1dbe0f575a2da759b90819e64125675da749624b2d8c580707fd6a932685ab3962b5b88353981e857fe9793

                • C:\Users\Admin\AppData\Roaming\3.exe

                  MD5

                  d2e2c65fc9098a1c6a4c00f9036aa095

                  SHA1

                  c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd

                  SHA256

                  4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8

                  SHA512

                  b5bd047ca4ee73965719669b29478a9d33665752e1dbe0f575a2da759b90819e64125675da749624b2d8c580707fd6a932685ab3962b5b88353981e857fe9793

                • C:\Users\Admin\AppData\Roaming\30.exe

                  MD5

                  fc44b935b0188657684c40113f7ab81c

                  SHA1

                  76c4a1262eb49daa55a24aadd7e3a48f2c22abd2

                  SHA256

                  f5b2489109d68b6ac83b453b8df1c7e1e9ec2636e162efdbaab4d27c1ce2dd69

                  SHA512

                  95cdf42503a546b8c3de9c1d0f0ffc5fca9955739591e011ec1dfd8b5c83492bc14261bbb042275f281cc12b59edb071e3dd72dad64c11481d118910a6052f9a

                • C:\Users\Admin\AppData\Roaming\30.exe

                  MD5

                  fc44b935b0188657684c40113f7ab81c

                  SHA1

                  76c4a1262eb49daa55a24aadd7e3a48f2c22abd2

                  SHA256

                  f5b2489109d68b6ac83b453b8df1c7e1e9ec2636e162efdbaab4d27c1ce2dd69

                  SHA512

                  95cdf42503a546b8c3de9c1d0f0ffc5fca9955739591e011ec1dfd8b5c83492bc14261bbb042275f281cc12b59edb071e3dd72dad64c11481d118910a6052f9a

                • C:\Users\Admin\AppData\Roaming\31.exe

                  MD5

                  4c4f3c4c8145b2bb3f79dc1a79f013a9

                  SHA1

                  9b1d80f6f950d30d134537f16f1f24fb66a41543

                  SHA256

                  f9f9b4e7abf29743486aeb210d474fee24b38a0e2f97d082ab0fe3dabc14b47b

                  SHA512

                  7c842577871a8bdf80a3da9dad91dea92dce764c00c874c821cbe2998a0a9d9921f0efb28bd5465deef02a6a6fdcb682a75b25976d7fac421fad8bf39d1c6c37

                • C:\Users\Admin\AppData\Roaming\31.exe

                  MD5

                  4c4f3c4c8145b2bb3f79dc1a79f013a9

                  SHA1

                  9b1d80f6f950d30d134537f16f1f24fb66a41543

                  SHA256

                  f9f9b4e7abf29743486aeb210d474fee24b38a0e2f97d082ab0fe3dabc14b47b

                  SHA512

                  7c842577871a8bdf80a3da9dad91dea92dce764c00c874c821cbe2998a0a9d9921f0efb28bd5465deef02a6a6fdcb682a75b25976d7fac421fad8bf39d1c6c37

                • C:\Users\Admin\AppData\Roaming\4.dll

                  MD5

                  986d769a639a877a9b8f4fb3c8616911

                  SHA1

                  ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

                  SHA256

                  c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

                  SHA512

                  3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

                • C:\Users\Admin\AppData\Roaming\4.exe

                  MD5

                  ec7506c2b6460df44c18e61d39d5b1c0

                  SHA1

                  7c3e46cd7c93f3d9d783888f04f1607f6e487783

                  SHA256

                  4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d

                  SHA512

                  cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e

                • C:\Users\Admin\AppData\Roaming\4.exe

                  MD5

                  ec7506c2b6460df44c18e61d39d5b1c0

                  SHA1

                  7c3e46cd7c93f3d9d783888f04f1607f6e487783

                  SHA256

                  4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d

                  SHA512

                  cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e

                • C:\Users\Admin\AppData\Roaming\5.exe

                  MD5

                  4fcc5db607dbd9e1afb6667ab040310e

                  SHA1

                  48af3f2d0755f0fa644fb4b7f9a1378e1d318ab9

                  SHA256

                  6fb0eacc8a7abaa853b60c064b464d7e87b02ef33d52b0e9a928622f4e4f37c7

                  SHA512

                  a46ded4552febd7983e09069d26ab2885a8087a9d43904ad0fedcc94a5c65fe0124bbf0a7d3e7283cb3459883e53c95f07fa6724b45f3a9488b147de42221a26

                • C:\Users\Admin\AppData\Roaming\5.exe

                  MD5

                  4fcc5db607dbd9e1afb6667ab040310e

                  SHA1

                  48af3f2d0755f0fa644fb4b7f9a1378e1d318ab9

                  SHA256

                  6fb0eacc8a7abaa853b60c064b464d7e87b02ef33d52b0e9a928622f4e4f37c7

                  SHA512

                  a46ded4552febd7983e09069d26ab2885a8087a9d43904ad0fedcc94a5c65fe0124bbf0a7d3e7283cb3459883e53c95f07fa6724b45f3a9488b147de42221a26

                • C:\Users\Admin\AppData\Roaming\6.exe

                  MD5

                  cf04c482d91c7174616fb8e83288065a

                  SHA1

                  6444eb10ec9092826d712c1efad73e74c2adae14

                  SHA256

                  7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf

                  SHA512

                  3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

                • C:\Users\Admin\AppData\Roaming\6.exe

                  MD5

                  cf04c482d91c7174616fb8e83288065a

                  SHA1

                  6444eb10ec9092826d712c1efad73e74c2adae14

                  SHA256

                  7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf

                  SHA512

                  3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

                • C:\Users\Admin\AppData\Roaming\7.exe

                  MD5

                  42d1caf715d4bd2ea1fade5dffb95682

                  SHA1

                  c26cff675630cbc11207056d4708666a9c80dab5

                  SHA256

                  8ea389ee2875cc95c5cd2ca62ba8a515b15ab07d0dd7d85841884cbb2a1fceea

                  SHA512

                  b21a0c4b19ffbafb3cac7fad299617ca5221e61cc8d0dca6d091d26c31338878b8d24fe98a52397e909aaad4385769aee863038f8c30663130718d577587527f

                • C:\Users\Admin\AppData\Roaming\7.exe

                  MD5

                  42d1caf715d4bd2ea1fade5dffb95682

                  SHA1

                  c26cff675630cbc11207056d4708666a9c80dab5

                  SHA256

                  8ea389ee2875cc95c5cd2ca62ba8a515b15ab07d0dd7d85841884cbb2a1fceea

                  SHA512

                  b21a0c4b19ffbafb3cac7fad299617ca5221e61cc8d0dca6d091d26c31338878b8d24fe98a52397e909aaad4385769aee863038f8c30663130718d577587527f

                • C:\Users\Admin\AppData\Roaming\8.exe

                  MD5

                  dea5598aaf3e9dcc3073ba73d972ab17

                  SHA1

                  51da8356e81c5acff3c876dffbf52195fe87d97f

                  SHA256

                  8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

                  SHA512

                  a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

                • C:\Users\Admin\AppData\Roaming\8.exe

                  MD5

                  dea5598aaf3e9dcc3073ba73d972ab17

                  SHA1

                  51da8356e81c5acff3c876dffbf52195fe87d97f

                  SHA256

                  8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

                  SHA512

                  a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

                • C:\Users\Admin\AppData\Roaming\9.exe

                  MD5

                  ea88f31d6cc55d8f7a9260245988dab6

                  SHA1

                  9e725bae655c21772c10f2d64a5831b98f7d93dd

                  SHA256

                  33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447

                  SHA512

                  5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

                • C:\Users\Admin\AppData\Roaming\9.exe

                  MD5

                  ea88f31d6cc55d8f7a9260245988dab6

                  SHA1

                  9e725bae655c21772c10f2d64a5831b98f7d93dd

                  SHA256

                  33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447

                  SHA512

                  5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

                • C:\Users\Admin\AppData\Roaming\9.exe

                  MD5

                  ea88f31d6cc55d8f7a9260245988dab6

                  SHA1

                  9e725bae655c21772c10f2d64a5831b98f7d93dd

                  SHA256

                  33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447

                  SHA512

                  5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

                • C:\Users\Admin\AppData\Roaming\9.exe

                  MD5

                  ea88f31d6cc55d8f7a9260245988dab6

                  SHA1

                  9e725bae655c21772c10f2d64a5831b98f7d93dd

                  SHA256

                  33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447

                  SHA512

                  5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

                • C:\Users\Admin\AppData\Roaming\AnLKhBlJfQ.exe

                  MD5

                  9d4da0e623bb9bb818be455b4c5e97d8

                  SHA1

                  9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0

                  SHA256

                  091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8

                  SHA512

                  6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

                • C:\Users\Admin\AppData\Roaming\J-96T9R9\J-9logim.jpeg

                  MD5

                  222f0c97a5dd739364a21b03d4c87340

                  SHA1

                  65b3597fe2ab58fba7b6f47fab2b7ab406caedcc

                  SHA256

                  47d1ab788c4acaf5f5321367a8152c4babc3e05a7c5fa3e7dcc989468a0d68b0

                  SHA512

                  c8df50f229d6811cd654ad21e78579639814ad9877a848fc2313525231cccb3c5603c474bdd5646ba4daec6810eee03247ac3f1eba0de62adfb54ed921049a15

                • C:\Users\Admin\AppData\Roaming\J-96T9R9\J-9logri.ini

                  MD5

                  d63a82e5d81e02e399090af26db0b9cb

                  SHA1

                  91d0014c8f54743bba141fd60c9d963f869d76c9

                  SHA256

                  eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

                  SHA512

                  38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

                • C:\Users\Admin\AppData\Roaming\J-96T9R9\J-9logrv.ini

                  MD5

                  ba3b6bc807d4f76794c4b81b09bb9ba5

                  SHA1

                  24cb89501f0212ff3095ecc0aba97dd563718fb1

                  SHA256

                  6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

                  SHA512

                  ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3341490333-719741536-2920803124-1000\83aa4cc77f591dfc2374580bbd95f6ba_4a1d5b5d-6336-41a4-a4da-b4af65e6deff

                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                • C:\Users\Admin\AppData\Roaming\Microsoft\Vyfdicgkuq\ujlejb.dat

                  MD5

                  3025ab17d6ce110e3f772dbec59c638d

                  SHA1

                  e23a381bf74c0568dd24969e8bdc3e03b2bc4688

                  SHA256

                  bcfc9bb6ec12052c714326cdf0ccaedfe4540ecf0424d121d6a3f7bf83cc5119

                  SHA512

                  c76e31368a06d1d79cdce120771ae4da9babc054761933390899ae1f03a75a3109b0d3e6a49e9bc4ca8d3cd4650af5afcf1f918e920a303c598123cdee750f8b

                • C:\Users\Admin\AppData\Roaming\Microsoft\Vyfdicgkuq\ujlejb.exe

                  MD5

                  3d2c6861b6d0899004f8abe7362f45b7

                  SHA1

                  33855b9a9a52f9183788b169cc5d57e6ad9da994

                  SHA256

                  dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

                  SHA512

                  19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

                • C:\Users\Admin\AppData\Roaming\Microsoft\Vyfdicgkuq\ujlejb.exe

                  MD5

                  3d2c6861b6d0899004f8abe7362f45b7

                  SHA1

                  33855b9a9a52f9183788b169cc5d57e6ad9da994

                  SHA256

                  dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

                  SHA512

                  19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

                • C:\Users\Admin\AppData\Roaming\Microsoft\Vyfdicgkuq\ujlejb.exe

                  MD5

                  3d2c6861b6d0899004f8abe7362f45b7

                  SHA1

                  33855b9a9a52f9183788b169cc5d57e6ad9da994

                  SHA256

                  dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

                  SHA512

                  19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

                • C:\Users\Admin\AppData\Roaming\Microsoft\Vyfdicgkuq\ujlejb.exe

                  MD5

                  3d2c6861b6d0899004f8abe7362f45b7

                  SHA1

                  33855b9a9a52f9183788b169cc5d57e6ad9da994

                  SHA256

                  dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

                  SHA512

                  19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

                  MD5

                  62aae235bcbc0d92498ad74af01f3052

                  SHA1

                  62b82ddb8fe01263dfd748923cfe94c84404343d

                  SHA256

                  d5087a3e63d55e7386ee91b4970caf2e789bfe6f9656813774586b90ec11b218

                  SHA512

                  7151cc3f4dcbc2fd21883e7fbc99aab298892ec279e555f93ef4adbae3b524989023b4c1f6a151109c47a748b42887d72bdb9a4781816f9bfa3466592a00ed3e

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupCMD28.lnk

                  MD5

                  32d33213108f9ff466a732f0a016893d

                  SHA1

                  3f720c5f6a9c53dfd476dbc24bc80abcab10b571

                  SHA256

                  dd0ebed423e1d830b353478f83091a9d91514aef0b8554efea27baf8d1295ca9

                  SHA512

                  22c6fd9068a5c7a565a90d18ba1268fe78a54fd3db3854a78220293608bad1a7fd792e9d9fd91b05eb425bd6448b26fb81ff0ae6ab84962b02486b9215b98ae0

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

                  MD5

                  d7bfa7e0bb306cf07056428e20487b79

                  SHA1

                  fcfeed269e3d9df0ef8e638b8ef0927c05d5984f

                  SHA256

                  b25bba13e4b158098ccf3c6dff94a29c4e45546ada42fda01f056f4fccd04cc8

                  SHA512

                  c9936dd3c26a73c63ce702de42c923ca18aa64385b545a991b2c4ba0a0a8251fb909d2c3d0a2ad231ce5758037d7e77cb414003339dafcc67330a013dd6a618a

                • C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogim.jpeg

                  MD5

                  95bb51276eee629e758024a9049c4147

                  SHA1

                  880d4e3bafdc989e82f08f0b6575b321eaad2546

                  SHA256

                  54ec767b92bffbd9265892ae1714fac80365014819207cecfc874382a3fc8173

                  SHA512

                  6a178aee0fcbd2337e1c0d54c3161aaac917ad6dcaf2e58f4ee40913628733e88f1ed1cbbcfd21e870519530bc3f0018ef86f3c17242f96c48470a17ecd92e03

                • C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogri.ini

                  MD5

                  d63a82e5d81e02e399090af26db0b9cb

                  SHA1

                  91d0014c8f54743bba141fd60c9d963f869d76c9

                  SHA256

                  eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

                  SHA512

                  38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

                • C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogrv.ini

                  MD5

                  ba3b6bc807d4f76794c4b81b09bb9ba5

                  SHA1

                  24cb89501f0212ff3095ecc0aba97dd563718fb1

                  SHA256

                  6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

                  SHA512

                  ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

                • C:\Users\Admin\AppData\Roaming\feeed.exe

                  MD5

                  dea5598aaf3e9dcc3073ba73d972ab17

                  SHA1

                  51da8356e81c5acff3c876dffbf52195fe87d97f

                  SHA256

                  8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

                  SHA512

                  a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

                • C:\Users\Admin\AppData\Roaming\feeed.exe

                  MD5

                  dea5598aaf3e9dcc3073ba73d972ab17

                  SHA1

                  51da8356e81c5acff3c876dffbf52195fe87d97f

                  SHA256

                  8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

                  SHA512

                  a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

                • C:\Users\Admin\AppData\Roaming\wWTxgR.exe

                  MD5

                  d41d8cd98f00b204e9800998ecf8427e

                  SHA1

                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                  SHA256

                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                  SHA512

                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                • C:\Users\Admin\Favorites\Bing.url.id-9E4BD7C5.[Bit_decrypt@protonmail.com].BOMBO

                  MD5

                  ba3f6df30194c3ccb59699e06cb2d297

                  SHA1

                  15dd0fc9feb783a8bf4603e82827ee88949960cb

                  SHA256

                  020564bfce51e7f39a6f108e49a44ceb4b37f2055d92288ec4c43212c9dcdab0

                  SHA512

                  e5f8766af6692192e9cd24af6f0926814fdee949778d1263f2861aa4ccd2e3fcdf8876d63a8625273ff33b677f45228068b654d702fd675a121a5134e5c382d2

                • C:\Windows\system32\drivers\etc\hosts

                  MD5

                  5b2d17233558878a82ee464d04f58b59

                  SHA1

                  47ebffcad0b4c358df0d6a06ef335cb6aab0ab20

                  SHA256

                  5b036588bb4cad3de01dd04988af705da135d9f394755080cf9941444c09a542

                  SHA512

                  d2aec9779eb8803514213a8e396b2f7c0b4a6f57de1ee84e9db0343ee5ff093e26bb70e0737a6681e21e88898ef5139969ff0b4b700cb6727979bd898fdbc85b

                • \Users\Admin\AppData\Roaming\29.dll

                  MD5

                  986d769a639a877a9b8f4fb3c8616911

                  SHA1

                  ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

                  SHA256

                  c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

                  SHA512

                  3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

                • \Users\Admin\AppData\Roaming\29.dll

                  MD5

                  986d769a639a877a9b8f4fb3c8616911

                  SHA1

                  ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

                  SHA256

                  c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

                  SHA512

                  3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

                • \Users\Admin\AppData\Roaming\4.dll

                  MD5

                  986d769a639a877a9b8f4fb3c8616911

                  SHA1

                  ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

                  SHA256

                  c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

                  SHA512

                  3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

                • \Users\Admin\AppData\Roaming\4.dll

                  MD5

                  986d769a639a877a9b8f4fb3c8616911

                  SHA1

                  ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

                  SHA256

                  c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

                  SHA512

                  3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

                • \Users\Admin\AppData\Roaming\4.dll

                  MD5

                  986d769a639a877a9b8f4fb3c8616911

                  SHA1

                  ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

                  SHA256

                  c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

                  SHA512

                  3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

                • \Users\Admin\AppData\Roaming\4.dll

                  MD5

                  986d769a639a877a9b8f4fb3c8616911

                  SHA1

                  ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

                  SHA256

                  c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

                  SHA512

                  3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

                • memory/8-21-0x0000000000000000-mapping.dmp

                • memory/8-23-0x0000000000000000-mapping.dmp

                • memory/136-395-0x0000000000000000-mapping.dmp

                • memory/136-410-0x0000000002050000-0x000000000208A000-memory.dmp

                • memory/192-387-0x0000000000000000-mapping.dmp

                • memory/192-386-0x0000000000000000-mapping.dmp

                • memory/264-436-0x0000000000000000-mapping.dmp

                • memory/272-453-0x0000000000000000-mapping.dmp

                • memory/308-440-0x0000000000030000-0x0000000000057000-memory.dmp

                • memory/308-438-0x0000000000030000-0x0000000000057000-memory.dmp

                • memory/308-437-0x0000000000000000-mapping.dmp

                • memory/500-132-0x00000000036C0000-0x00000000036C1000-memory.dmp

                • memory/500-19-0x0000000000000000-mapping.dmp

                • memory/500-18-0x0000000000000000-mapping.dmp

                • memory/692-404-0x0000000000000000-mapping.dmp

                • memory/784-200-0x0000000000000000-mapping.dmp

                • memory/960-161-0x0000000000000000-mapping.dmp

                • memory/992-334-0x0000000000000000-mapping.dmp

                • memory/992-331-0x0000000000000000-mapping.dmp

                • memory/996-382-0x0000000000000000-mapping.dmp

                • memory/996-378-0x0000000000000000-mapping.dmp

                • memory/1016-115-0x0000000000000000-mapping.dmp

                • memory/1016-113-0x0000000000000000-mapping.dmp

                • memory/1140-813-0x00000000000000E0-mapping.dmp

                • memory/1140-806-0x0000000000000000-mapping.dmp

                • memory/1164-785-0x0000000000000000-mapping.dmp

                • memory/1164-790-0x00000000000000E4-mapping.dmp

                • memory/1264-25-0x0000000000000000-mapping.dmp

                • memory/1264-41-0x0000000000630000-0x0000000000640000-memory.dmp

                • memory/1264-27-0x0000000000000000-mapping.dmp

                • memory/1364-575-0x00000000000000E0-mapping.dmp

                • memory/1364-572-0x0000000000000000-mapping.dmp

                • memory/1372-407-0x0000000000000000-mapping.dmp

                • memory/1384-241-0x0000000003160000-0x0000000003161000-memory.dmp

                • memory/1384-128-0x0000000000000000-mapping.dmp

                • memory/1384-239-0x0000000003073000-0x0000000003074000-memory.dmp

                • memory/1384-126-0x0000000000000000-mapping.dmp

                • memory/1668-283-0x0000000001240000-0x000000000124C000-memory.dmp

                • memory/1668-286-0x0000000001240000-0x000000000124C000-memory.dmp

                • memory/1668-373-0x0000000006270000-0x00000000063CA000-memory.dmp

                • memory/1668-278-0x0000000000000000-mapping.dmp

                • memory/1668-456-0x0000000006D60000-0x0000000006EFE000-memory.dmp

                • memory/1676-75-0x0000000000000000-mapping.dmp

                • memory/1680-135-0x00000000004015B4-mapping.dmp

                • memory/1816-258-0x0000000000000000-mapping.dmp

                • memory/1820-608-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-484-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-715-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-151-0x0000000005420000-0x0000000005584000-memory.dmp

                • memory/1820-588-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-733-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-596-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-701-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-666-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-662-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-638-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-636-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-633-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-626-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-789-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-542-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-450-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-812-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-600-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-625-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-574-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-55-0x0000000001240000-0x000000000124C000-memory.dmp

                • memory/1820-755-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-618-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-590-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-51-0x0000000000000000-mapping.dmp

                • memory/1820-615-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-547-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-614-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-787-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-559-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-771-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1820-59-0x0000000001240000-0x000000000124C000-memory.dmp

                • memory/1820-434-0x0000000005560000-0x0000000005657000-memory.dmp

                • memory/1928-750-0x0000000000000000-mapping.dmp

                • memory/1928-756-0x00000000000000E0-mapping.dmp

                • memory/1932-719-0x0000000000000000-mapping.dmp

                • memory/2000-32-0x0000000000000000-mapping.dmp

                • memory/2000-31-0x0000000000000000-mapping.dmp

                • memory/2096-442-0x0000000000000000-mapping.dmp

                • memory/2152-729-0x0000000000000000-mapping.dmp

                • memory/2152-735-0x00000000000000E0-mapping.dmp

                • memory/2156-163-0x0000000000000000-mapping.dmp

                • memory/2160-248-0x0000000000190000-0x0000000000196000-memory.dmp

                • memory/2160-250-0x0000000000190000-0x0000000000196000-memory.dmp

                • memory/2160-355-0x00000000055E0000-0x0000000005730000-memory.dmp

                • memory/2160-247-0x0000000000000000-mapping.dmp

                • memory/2308-45-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/2308-74-0x0000000005A40000-0x0000000005A42000-memory.dmp

                • memory/2308-73-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

                • memory/2308-57-0x0000000002F10000-0x0000000002F12000-memory.dmp

                • memory/2308-53-0x0000000005C80000-0x0000000005C81000-memory.dmp

                • memory/2308-50-0x0000000002F00000-0x0000000002F0F000-memory.dmp

                • memory/2308-39-0x0000000000000000-mapping.dmp

                • memory/2308-42-0x0000000000000000-mapping.dmp

                • memory/2308-71-0x0000000005A30000-0x0000000005A32000-memory.dmp

                • memory/2308-47-0x0000000000E20000-0x0000000000E21000-memory.dmp

                • memory/2308-60-0x0000000005820000-0x0000000005821000-memory.dmp

                • memory/2340-188-0x0000000000000000-mapping.dmp

                • memory/2352-109-0x0000000000000000-mapping.dmp

                • memory/2456-667-0x00000000000000E0-mapping.dmp

                • memory/2456-660-0x0000000000000000-mapping.dmp

                • memory/2532-325-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/2532-321-0x0000000000000000-mapping.dmp

                • memory/2532-320-0x0000000000000000-mapping.dmp

                • memory/2532-379-0x0000000008C90000-0x0000000008CE1000-memory.dmp

                • memory/2532-359-0x0000000005400000-0x000000000545D000-memory.dmp

                • memory/2532-329-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

                • memory/2552-705-0x000000000C2A0000-0x000000000C2A1000-memory.dmp

                • memory/2552-264-0x0000000007990000-0x0000000007B1F000-memory.dmp

                • memory/2552-539-0x00000000071D0000-0x00000000072B0000-memory.dmp

                • memory/2748-475-0x0000000000000000-mapping.dmp

                • memory/2844-399-0x0000000000000000-mapping.dmp

                • memory/2848-246-0x0000000000000000-mapping.dmp

                • memory/2960-90-0x00000000081D0000-0x00000000081D1000-memory.dmp

                • memory/2960-54-0x0000000000000000-mapping.dmp

                • memory/2960-88-0x00000000080D0000-0x0000000008123000-memory.dmp

                • memory/2960-64-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/2960-66-0x00000000000D0000-0x00000000000D1000-memory.dmp

                • memory/2960-78-0x00000000049D0000-0x00000000049D1000-memory.dmp

                • memory/2960-58-0x0000000000000000-mapping.dmp

                • memory/2960-84-0x0000000004C40000-0x0000000004C42000-memory.dmp

                • memory/3084-14-0x000000000041E2D0-mapping.dmp

                • memory/3084-13-0x0000000000400000-0x000000000042D000-memory.dmp

                • memory/3088-213-0x0000000000000000-mapping.dmp

                • memory/3088-212-0x0000000000000000-mapping.dmp

                • memory/3100-4-0x0000000000000000-mapping.dmp

                • memory/3100-5-0x0000000000000000-mapping.dmp

                • memory/3180-157-0x00000000004015B0-mapping.dmp

                • memory/3200-458-0x0000000000000000-mapping.dmp

                • memory/3224-257-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/3224-255-0x000000000044CCFE-mapping.dmp

                • memory/3224-254-0x0000000000400000-0x0000000000452000-memory.dmp

                • memory/3224-313-0x0000000005840000-0x0000000005841000-memory.dmp

                • memory/3312-480-0x0000000000000000-mapping.dmp

                • memory/3312-485-0x0000000000000000-mapping.dmp

                • memory/3356-663-0x0000015DD2D59000-0x0000015DD2D6B000-memory.dmp

                • memory/3368-447-0x0000000000400000-0x0000000000401000-memory.dmp

                • memory/3368-446-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/3368-445-0x000000000044CB3E-mapping.dmp

                • memory/3368-444-0x0000000000400000-0x0000000000452000-memory.dmp

                • memory/3384-602-0x00000000000000E0-mapping.dmp

                • memory/3384-599-0x0000000000000000-mapping.dmp

                • memory/3516-301-0x000000000E1C0000-0x000000000E352000-memory.dmp

                • memory/3516-310-0x00000000050E0000-0x00000000050E1000-memory.dmp

                • memory/3516-275-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

                • memory/3516-259-0x0000000000000000-mapping.dmp

                • memory/3516-262-0x0000000000000000-mapping.dmp

                • memory/3516-267-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/3516-271-0x0000000000C70000-0x0000000000C71000-memory.dmp

                • memory/3516-315-0x000000000AD60000-0x000000000AD61000-memory.dmp

                • memory/3620-720-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-767-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-673-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-766-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-768-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-658-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-770-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-765-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-775-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-694-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-764-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-763-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-695-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-762-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-696-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-457-0x0000000001D6BE5D-mapping.dmp

                • memory/3620-657-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-661-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-761-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-435-0x0000000000000000-mapping.dmp

                • memory/3620-645-0x0000000008FE0000-0x0000000008FE1000-memory.dmp

                • memory/3620-760-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-759-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-646-0x0000000008FE0000-0x0000000008FE1000-memory.dmp

                • memory/3620-758-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-757-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-697-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-427-0x0000000000000000-mapping.dmp

                • memory/3620-647-0x0000000008FE0000-0x0000000008FE1000-memory.dmp

                • memory/3620-706-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-754-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-753-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-707-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-713-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-751-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-717-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-749-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-648-0x0000000008FE0000-0x0000000008FE1000-memory.dmp

                • memory/3620-748-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-747-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-650-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-746-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-745-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-652-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-744-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-743-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-742-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-659-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-654-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-741-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-740-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-739-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-656-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-736-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-411-0x0000000000000000-mapping.dmp

                • memory/3620-653-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-724-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-722-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-721-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-777-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3620-671-0x0000000008F60000-0x0000000008F61000-memory.dmp

                • memory/3644-273-0x0000000000400000-0x000000000044E000-memory.dmp

                • memory/3644-274-0x0000000000449E3E-mapping.dmp

                • memory/3724-287-0x0000000000000000-mapping.dmp

                • memory/3788-0-0x0000000000000000-mapping.dmp

                • memory/3808-156-0x0000000000000000-mapping.dmp

                • memory/3808-155-0x0000000000000000-mapping.dmp

                • memory/3816-418-0x0000000000000000-mapping.dmp

                • memory/3820-3-0x0000000000000000-mapping.dmp

                • memory/3824-184-0x0000000000000000-mapping.dmp

                • memory/3824-183-0x0000000000000000-mapping.dmp

                • memory/3824-195-0x0000000000D60000-0x0000000000D61000-memory.dmp

                • memory/3824-187-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/3824-203-0x0000000005610000-0x000000000565D000-memory.dmp

                • memory/3824-206-0x0000000005660000-0x000000000569A000-memory.dmp

                • memory/3944-350-0x0000000000000000-mapping.dmp

                • memory/3944-348-0x0000000000000000-mapping.dmp

                • memory/3984-93-0x0000000000000000-mapping.dmp

                • memory/3984-91-0x0000000000000000-mapping.dmp

                • memory/4092-616-0x00000000000000D4-mapping.dmp

                • memory/4092-613-0x0000000000000000-mapping.dmp

                • memory/4136-377-0x0000000000000000-mapping.dmp

                • memory/4136-393-0x00000000026F0000-0x00000000026F1000-memory.dmp

                • memory/4216-243-0x0000000000000000-mapping.dmp

                • memory/4216-242-0x0000000000000000-mapping.dmp

                • memory/4232-298-0x0000000000E40000-0x0000000000E41000-memory.dmp

                • memory/4232-295-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/4232-291-0x0000000000000000-mapping.dmp

                • memory/4232-318-0x0000000008940000-0x0000000008993000-memory.dmp

                • memory/4232-290-0x0000000000000000-mapping.dmp

                • memory/4248-9-0x0000000000000000-mapping.dmp

                • memory/4248-8-0x0000000000000000-mapping.dmp

                • memory/4292-280-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

                • memory/4292-190-0x0000000000000000-mapping.dmp

                • memory/4292-194-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/4300-282-0x0000000000000000-mapping.dmp

                • memory/4308-624-0x0000000000000000-mapping.dmp

                • memory/4308-627-0x00000000000000E0-mapping.dmp

                • memory/4332-300-0x0000000000000000-mapping.dmp

                • memory/4348-597-0x00000000000000E0-mapping.dmp

                • memory/4348-594-0x0000000000000000-mapping.dmp

                • memory/4368-408-0x0000000002690000-0x0000000002691000-memory.dmp

                • memory/4368-405-0x0000000000000000-mapping.dmp

                • memory/4452-174-0x0000000000000000-mapping.dmp

                • memory/4452-296-0x0000000002F73000-0x0000000002F74000-memory.dmp

                • memory/4452-297-0x00000000031E0000-0x00000000031E1000-memory.dmp

                • memory/4452-175-0x0000000000000000-mapping.dmp

                • memory/4460-414-0x0000000000000000-mapping.dmp

                • memory/4536-712-0x0000000000000000-mapping.dmp

                • memory/4548-142-0x00000000031B0000-0x00000000031B1000-memory.dmp

                • memory/4548-137-0x0000000002E43000-0x0000000002E44000-memory.dmp

                • memory/4548-76-0x0000000000000000-mapping.dmp

                • memory/4548-79-0x0000000000000000-mapping.dmp

                • memory/4584-87-0x0000000000000000-mapping.dmp

                • memory/4588-182-0x0000000000000000-mapping.dmp

                • memory/4592-452-0x000001F322D95000-0x000001F322D96000-memory.dmp

                • memory/4596-308-0x0000000000000000-mapping.dmp

                • memory/4596-309-0x0000000000000000-mapping.dmp

                • memory/4608-369-0x0000000000000000-mapping.dmp

                • memory/4608-366-0x0000000000000000-mapping.dmp

                • memory/4608-400-0x00000000036B0000-0x00000000036B1000-memory.dmp

                • memory/4672-464-0x0000000000400000-0x0000000000450000-memory.dmp

                • memory/4672-467-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/4672-465-0x000000000044A49E-mapping.dmp

                • memory/4708-104-0x0000000000000000-mapping.dmp

                • memory/4708-106-0x0000000000000000-mapping.dmp

                • memory/4748-409-0x0000000000000000-mapping.dmp

                • memory/4760-483-0x0000000000000000-mapping.dmp

                • memory/4772-139-0x0000000000000000-mapping.dmp

                • memory/4772-141-0x0000000000000000-mapping.dmp

                • memory/4780-281-0x0000000000000000-mapping.dmp

                • memory/4780-279-0x0000000000000000-mapping.dmp

                • memory/4828-551-0x0000000000000000-mapping.dmp

                • memory/4828-560-0x00000000000000E0-mapping.dmp

                • memory/4832-349-0x00000000004015B4-mapping.dmp

                • memory/4888-339-0x000000000044C82E-mapping.dmp

                • memory/4888-341-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/4888-338-0x0000000000400000-0x0000000000452000-memory.dmp

                • memory/4932-441-0x0000000000000000-mapping.dmp

                • memory/4956-362-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/4956-358-0x000000000044CF8E-mapping.dmp

                • memory/4956-364-0x00000000007C0000-0x0000000000812000-memory.dmp

                • memory/5048-426-0x000000000041E2D0-mapping.dmp

                • memory/5052-543-0x0000000000000000-mapping.dmp

                • memory/5052-546-0x0000000001000000-0x00000000012FC000-memory.dmp

                • memory/5052-545-0x0000000001000000-0x00000000012FC000-memory.dmp

                • memory/5112-229-0x000000000041E270-mapping.dmp

                • memory/5112-227-0x0000000000400000-0x000000000042D000-memory.dmp

                • memory/5116-230-0x0000000000000000-mapping.dmp

                • memory/5116-228-0x0000000000000000-mapping.dmp

                • memory/5144-486-0x0000000000000000-mapping.dmp

                • memory/5204-548-0x00000000000000E0-mapping.dmp

                • memory/5204-541-0x0000000000000000-mapping.dmp

                • memory/5240-682-0x0000000000000000-mapping.dmp

                • memory/5240-687-0x00000000000000E0-mapping.dmp

                • memory/5248-610-0x00000000000000E0-mapping.dmp

                • memory/5248-607-0x0000000000000000-mapping.dmp

                • memory/5272-491-0x0000000000000000-mapping.dmp

                • memory/5300-639-0x00000000000000E0-mapping.dmp

                • memory/5300-635-0x0000000000000000-mapping.dmp

                • memory/5304-620-0x00000000000000E0-mapping.dmp

                • memory/5304-617-0x0000000000000000-mapping.dmp

                • memory/5480-498-0x0000000000000000-mapping.dmp

                • memory/5580-641-0x0000000000000000-mapping.dmp

                • memory/5580-644-0x00000000000000E0-mapping.dmp

                • memory/5600-558-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/5600-555-0x0000000000400000-0x000000000044C000-memory.dmp

                • memory/5600-556-0x0000000000445D5E-mapping.dmp

                • memory/5600-557-0x0000000000400000-0x000000000044C000-memory.dmp

                • memory/5608-711-0x0000000000000000-mapping.dmp

                • memory/5608-716-0x00000000000000E0-mapping.dmp

                • memory/5652-505-0x0000000000000000-mapping.dmp

                • memory/5712-508-0x000000000041E270-mapping.dmp

                • memory/5788-511-0x0000000000000000-mapping.dmp

                • memory/5788-512-0x0000000000F90000-0x0000000000F9A000-memory.dmp

                • memory/5788-513-0x0000000000F90000-0x0000000000F9A000-memory.dmp

                • memory/5856-631-0x0000000000000000-mapping.dmp

                • memory/5856-634-0x00000000000000EC-mapping.dmp

                • memory/5860-824-0x0000000000000000-mapping.dmp

                • memory/5880-637-0x000001D0D98FF000-0x000001D0D9904000-memory.dmp

                • memory/5936-769-0x0000000000000000-mapping.dmp

                • memory/5936-774-0x00000000000000EC-mapping.dmp

                • memory/5972-522-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/5972-519-0x0000000000000000-mapping.dmp

                • memory/6004-702-0x00000257D088D000-0x00000257D088F000-memory.dmp

                • memory/6044-589-0x00000232D575C000-0x00000232D575F000-memory.dmp

                • memory/6048-528-0x0000000000000000-mapping.dmp

                • memory/6048-531-0x0000000070970000-0x000000007105E000-memory.dmp

                • memory/6112-540-0x0000000000280000-0x000000000029F000-memory.dmp

                • memory/6112-538-0x0000000000280000-0x000000000029F000-memory.dmp

                • memory/6112-537-0x0000000000000000-mapping.dmp

                • memory/6120-568-0x00000219D7690000-0x00000219D7694000-memory.dmp

                • memory/6128-591-0x00000000000000E0-mapping.dmp

                • memory/6128-587-0x0000000000000000-mapping.dmp